Loading story…
Threat actors targeted cryptocurrency and NFT communities with phishing messages and spoofed NFT project websites that impersonated legitimate services to trick users into downloading malware. One campaign used a fake Pixelmon site, pixelmon[.]pw, to mimic the real project and deliver ZIP archives containing Windows shortcut and script payloads that installed Vidar infostealer, which steals passwords, cryptocurrency wallet data, and sensitive files. Researchers found Vidar obtained command-and-control details through a Telegram channel and could fetch additional modules from its C2 infrastructure.
A separate but related campaign tracked as NFT-001 used Discord and similar forums to lure victims to decoy crypto sites, where a malicious installer deployed Remcos RAT and, in newer variants, Eternity Stealer. Morphisec reported the operators changed tooling from the Babadeda crypter to a staged downloader while keeping similar delivery infrastructure and some overlapping C2 elements. The newer downloader performed a UAC bypass, added C:\ to Microsoft Defender exclusions, and retrieved follow-on payloads to improve evasion and credential theft, showing continued refinement of malware delivery against NFT and crypto users.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
In June 2022, the NFT-001 threat actor changed its delivery chain from the Babadeda crypter to a new staged downloader while keeping similar delivery infrastructure. Morphisec said the newer downloader added stronger defense-evasion behavior and later delivered Remcos RAT and Eternity Stealer.
Morphisec said the NFT-001 malware campaign has targeted users in crypto and NFT communities since November 2020, primarily through phishing messages on Discord and similar forums that led victims to fake crypto-themed sites.
The fake Pixelmon site served ZIP archives including setup.zip, whose LNK file launched PowerShell to download system32.hta and install Vidar infostealer. Researchers found the malware used Telegram to obtain command-and-control information and then downloaded additional modules to steal passwords, wallet data, and other sensitive files.
Threat actors set up a fake Pixelmon website at pixelmon[.]pw impersonating the legitimate pixelmon.club project to lure users with free tokens and collectibles into downloading malware. MalwareHunterTeam was credited with first discovering the malicious site.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 48 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used fake cryptocurrency-themed websites to distribute **SpyAgent**, a malware loader that communicates with command-and-control servers using periodic HTTP `GET` requests containing a 9-digit victim ID and an environment hash derived from system values such as `MachineGuid`, Windows product name, username, and computer name. The malware also monitored keyboard and mouse inactivity, reporting when a victim became idle, how long the idle period lasted, and when activity resumed, giving operators visibility into when a compromised device was unattended. The campaign appeared financially motivated and was geared toward credential theft, cryptocurrency wallet theft, and clipboard hijacking to replace wallet addresses during transactions. SpyAgent was used to fetch and run additional commodity malware, including **RedLine Stealer, Ducky stealer, AZORult, Cypress Stealer, Clipper, Remcos RAT, NanoCore, njRAT, and AsyncRAT**, expanding the operators’ ability to steal data, maintain access, and monetize infected systems.
Aug 14, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026